ASD ISM 2152 Segregate backup infrastructure with separate administrative authentication
What it says
Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep backup servers, repositories and consoles apart from production, and log into them as an administrator through a different authentication system than production uses.
Backups are the thing you fall back on when production is lost, so they must not fall at the same time production does. This control has two parts. First, the backup infrastructure (the backup servers, the repositories where backup data is stored, and the management consoles used to run the backup system) is kept segregated from the production environment rather than sitting on the same network segments and hosts as the systems it protects. Second, administrative access to that backup infrastructure uses a separate authentication mechanism, so the credentials and identity system that grant production administrator rights do not also grant backup administrator rights. The real-world risk is straightforward. Ransomware operators and intruders who gain a production domain administrator account routinely go looking for the backups first, because deleting or encrypting them removes the organisation's ability to recover without paying. If the backup console trusts the same directory as production and the backup repository is reachable from any production server, one compromised administrator account is enough to destroy both the live data and every copy of it. Segregation limits what an attacker inside production can reach, and separate authentication means the credentials they already hold do not open the backup system.
Free. Save your status, tasks and notes.
Why it matters
If backup infrastructure shares the production environment and its authentication, a single compromised production administrator account or a piece of ransomware that spreads through production can reach the backup servers, wipe or encrypt the repositories, and disable the backup management console. The organisation then has no clean copy to restore from, turning a recoverable incident into permanent data loss, prolonged outage, and possible extortion. Segregated infrastructure with separate administrative authentication keeps at least one recovery path out of the attacker's hands.
How to implement
The infrastructure team documents every component of the backup infrastructure (backup servers, backup repositories and storage targets, and management consoles) and confirms each one is placed in a network zone or environment that is segregated from production, moving any component currently co-located with production systems.
The network team restricts traffic between production and the backup zone to only the ports and directions the backup jobs require, using firewall rules, VLAN separation or cloud security groups, and blocks general administrative protocols from production into the backup zone.
The backup platform owner configures administrative access to the backup console, servers and repositories to use a separate authentication mechanism from production, such as the backup product's own local accounts or a dedicated identity store that production administrators cannot reach.
The backup administrators create distinct administrative accounts within that separate mechanism for each person who manages backups, and remove any production domain accounts or groups that were previously granted administrative rights on the backup system.
The change manager adds a standing check to the change process so that any new backup server, repository or console is built inside the segregated zone and onboarded to the separate authentication mechanism before it goes live.
Keep it running
Day to day, this control shows up as friction that must be preserved rather than smoothed away. Backup administrators sign in to the backup console with an account that lives in the backup system's own authentication mechanism (a local identity store, a dedicated directory, or an equivalent) and not with their production domain credentials. Network paths between production and the backup servers and repositories are limited to what the backup jobs themselves need, and changes to firewall rules, VLANs or cloud network configuration that would widen that path go through change control with the backup owner's approval.
Watch for drift. Common ways the control quietly erodes include someone joining the backup server to the production domain for convenience, a new repository being provisioned on a production storage array, a console being exposed on the general management network, or a shared "admin" login being reused for both environments. Include backup infrastructure placement and administrative authentication in periodic configuration checks, and treat any new backup component as needing the same segregation and separate login from the day it is built.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for a current inventory of backup infrastructure that lists each backup server, repository and management console with its network location.
Look at
Check that every component is placed in a zone or environment distinct from production, and that none is listed alongside production hosts or on production storage.
Good evidence
All backup servers, repositories and consoles sit in a separately identified backup zone, and the inventory is complete and recent.
- Check 2 of 5What an auditor asks for
Ask for
Ask for network diagrams and the firewall or security group rules governing traffic between production and the backup zone.
Look at
Look at what production systems can initiate towards backup servers and repositories, and whether administrative protocols are allowed through.
Good evidence
Only the specific ports the backup jobs need are permitted, and administrative access from production into the backup zone is blocked.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the authentication configuration of the backup management console and backup servers.
Look at
Identify which identity source the console and servers use for administrative login and whether it is the production directory.
Good evidence
Administrative access is authenticated by a mechanism separate from production, such as the backup product's own account store or a dedicated identity store.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the list of accounts and groups holding administrative rights on the backup infrastructure.
Look at
Compare the list against production administrator accounts and groups to see whether any production credentials also grant backup administration.
Good evidence
Backup administrative accounts exist only within the separate mechanism and no production domain accounts or groups carry backup administrative rights.
- Check 5 of 5What an auditor asks for
Ask for
Ask to observe a backup administrator logging in to the management console, or for a recent authentication log from the console.
Look at
Confirm which credentials and identity system are used at login and that a production domain login is not accepted.
Good evidence
The login uses a backup-specific administrative account through the separate mechanism, and the log shows no production-directory authentication events.
Mappings
Closest match in ISO/IEC 27001: A.8.22, Network segregation for security, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.8.22.
ISM-2152 requires backup infrastructure to be segregated from production and to use a separate authentication mechanism for administrative access. This supports ISO/IEC 27001:2022 Annex A 8.22 by being a concrete application of network/service segregation for a high-value environment (backup systems) to reduce lateral movement and privilege abuse. Annex A 8.22 is broader (segregation across groups of services/users/systems generally), while ISM-2152 is specific to backup infrastructure and admin authentication separation.
ASD Essential Eight: 4 mappings
This control supports E8-RB-ML1.6.
ISM-2152 requires segregation of backup infrastructure from production and separate administrative authentication for backup administration. This supports E8-RB-ML1.6 by making it harder for unprivileged production users (or compromised user sessions) to reach backup systems to modify or delete backups. E8-RB-ML1.6 specifies the access outcome (prevent modification/deletion), while ISM-2152 specifies a structural separation that helps achieve it.
This control supports E8-RB-ML2.1.
ISM-2152 requires segregating backup servers/repositories/consoles from production and using separate administrative authentication for backup administration. This supports E8-RB-ML2.1 by reducing the ability of non-backup privileged accounts to traverse from production administration into backup environments and access other users' backups. E8-RB-ML2.1 focuses on logical access authorisation to backup data, whereas ISM-2152 focuses on environmental and admin-auth separation that helps enforce those authorisations.
This control supports E8-RB-ML2.2.
ISM-2152 requires backup infrastructure to be segregated from production environments and administered via a separate authentication mechanism. This supports E8-RB-ML2.2 by helping ensure production privileged accounts cannot reach backup systems to modify or delete backups, because administrative access is isolated and separately controlled. E8-RB-ML2.2 is primarily an access restriction outcome, while ISM-2152 is an architectural and authentication segregation requirement that helps achieve that outcome.
This control supports E8-RB-ML3.2.
ISM-2152 requires segregated backup infrastructure and separate administrative authentication from production. This supports E8-RB-ML3.2 by helping prevent privileged accounts from using their normal production admin identities/paths to reach backup systems and access their own backups. E8-RB-ML3.2 is an explicit authorisation rule about who can access backups, while ISM-2152 is a segregation mechanism that helps enforce separation of duties and limits lateral movement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.